Introduction
A flaw in JetBrains IntelliJ IDEA's built-in web server lets an attacker read arbitrary local files from a developer's workstation by exploiting improper symbolic link resolution. IntelliJ IDEA is one of the most widely deployed IDEs in enterprise software development, and developer machines often hold credentials, private keys, configuration files, and source code. For any organization with unpatched installations, the exposure is significant.
The vulnerability, tracked as CVE-2026-41882, carries a CVSS score of 7.4. JetBrains published it on April 30, 2026. It affects five release branches, from the 2024.3.x line through 2026.1.x, which suggests the vulnerable code has been in the built-in web server for a long time.
Technical Information
Root Cause: CWE-59 and Improper Link Resolution
The vulnerability is in IntelliJ IDEA's built-in web server, a lightweight HTTP server that runs locally on the developer's machine. It supports several IDE features, including browser-based preview, debugger communication, and REST client functionality.
The root cause is classified as CWE-59 (Improper Link Resolution Before File Access), commonly called "Link Following." That classification means the web server did not properly validate or resolve symbolic links (or equivalent path references) before serving file content. When the built-in web server received a request for a file, it followed symbolic links without checking that the resolved target stayed within the expected directory scope.
This differs from classic directory traversal. CWE-59 covers cases where a program accesses a file through a name or reference it believes is trustworthy, but which resolves to an attacker-controlled location, typically through symbolic links or hard links. A simple ../ filter would not catch this class of issue, because the path itself may look well-formed. The trust boundary is crossed when the filesystem resolves the link.
Attack Flow
Working from the vulnerability description and what CWE-59 covers, the attack would proceed as follows:
- The attacker determines that the target is running IntelliJ IDEA with the built-in web server active (this server is enabled by default for many IDE workflows).
- The attacker crafts a request that references a file path which, through symbolic link resolution, points to an arbitrary file on the local filesystem outside the intended serving directory.
- The built-in web server processes the request, follows the symlink or resolves the path reference without proper canonicalization, and serves the content of the target file back to the requester.
- The attacker receives the contents of the file, which could include sensitive data such as SSH keys, environment variables, application secrets, or source code.
The public advisory does not detail the network exposure requirements or the authentication context. Because this is a locally running web server, though, the attack likely needs either local access or a way to make the developer's browser send requests to the local server (for example, a malicious web page using cross-origin requests).
Relationship to Prior Vulnerabilities
JetBrains has patched arbitrary file-read issues in the IntelliJ IDEA built-in web server before. CVE-2022-46826, fixed in version 2022.3, was a similar file-read flaw via path traversal (CWE-35). The recurrence under a different CWE suggests the earlier fix handled classic traversal sequences but did not account for link-following attack vectors, which the current patch now closes.
Patch Information
JetBrains released patched builds for CVE-2026-41882 across five supported IntelliJ IDEA release branches. Patching that many branches shows how wide the affected range is and how seriously the vendor took the flaw:
| Release Branch | Fixed Version |
|---|---|
| 2024.3.x | 2024.3.7.1 |
| 2025.1.x | 2025.1.7.1 |
| 2025.2.x | 2025.2.6.2 |
| 2025.3.x | 2025.3.4.1 |
| 2026.1.x | 2026.1.1 |
The fix targets the IDE's built-in web server component. Given the CWE-59 classification, the patch almost certainly adds link resolution checks and canonicalizes file paths before the built-in web server reads and serves file content, so symlinks and equivalent references cannot escape the expected directory scope.
IntelliJ IDEA is closed source, so no public source code diffs or commits are available. JetBrains delivers the patch only through its standard update channels:
- The Toolbox App (JetBrains' centralized IDE manager)
- In-IDE update prompts
- Snap packages for Ubuntu users
- Direct download from the JetBrains website
Organizations should group every endpoint by its IntelliJ IDEA release branch and deploy the matching update, so no branch stays on a vulnerable version. After deployment, confirm that each installed IDE version is equal to or later than the fixed version for its branch in the table above.
Affected Systems and Versions
The following IntelliJ IDEA versions are vulnerable:
| Release Branch | Vulnerable Versions | Fixed Version |
|---|---|---|
| IntelliJ IDEA 2024.3 | All versions before 2024.3.7.1 | 2024.3.7.1 |
| IntelliJ IDEA 2025.1 | All versions before 2025.1.7.1 | 2025.1.7.1 |
| IntelliJ IDEA 2025.2 | All versions before 2025.2.6.2 | 2025.2.6.2 |
| IntelliJ IDEA 2025.3 | All versions before 2025.3.4.1 | 2025.3.4.1 |
| IntelliJ IDEA 2026.1 | All versions before 2026.1.1 | 2026.1.1 |
The vulnerable component is the built-in web server, a core IntelliJ IDEA feature used for browser-based preview, debugger communication, and REST client functionality. Any installation where this server is active (the default for many development workflows) is potentially exposed.
Vendor Security History
JetBrains is transparent about security disclosure. Its centralized "Fixed security issues" page documents vulnerabilities across its entire product portfolio, and that record shows a pattern of security issues in IntelliJ IDEA's built-in web server:
| Historical CVE | Description | Severity | Resolved In |
|---|---|---|---|
| CVE-2022-46826 | The built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability | Medium | 2022.3 |
| CVE-2022-46825 | The built-in web server leaked information about open projects | Medium | 2022.3 |
| CVE-2022-48433 | The NTLM hash could leak through an API method used in the built-in web server | Medium | 2023.1 |
File-read vulnerabilities keep recurring in the same component, now under a different CWE classification (CWE-59 versus CWE-35 for the 2022 issue). That suggests earlier remediation addressed specific attack patterns rather than hardening the file-serving logic as a whole. Teams running IntelliJ IDEA should apply new fixes for this component promptly whenever JetBrains releases them.
